Nuances to be aware of

There are a couple of items to consider while configuring your FIM ingestion rules.

Wildcard behavior

Since the FIM supports file `GLOB`s you may be tempted to specify something like`C:\Users\%\Downloads\%%` in your FIM category. While this doesn’t cause errors, specifying this way, in-lieu of monitoring the directory itself, may result in unexpected behavior like the following:

1. Osquery agent retrieves FIM configuration

2. Recursively searches paths specified by the FIM category(eg. 

C:\Users\%\Downloads\%%

)

3. Registers each file found via that pattern to be watched for changes.

This means that files created after FIM configuration retrieval (during which, files are registered to be watched) will be ignored by the FIM.

This is also true for the first 

%

 in our path. If new users are added to the system, they will not be watched until the FIM capability in Osquery is restarted.

If this is behavior you want (like on a server where you only care if existing files critical to its tasks are mutated), then the wildcards are the right tool for the job. Otherwise, we suggest simply naming the directory you want to watch.